[arch-security] [ASA-201605-13] squid: multiple issues
rgacogne at archlinux.org
Tue May 10 17:58:04 UTC 2016
Arch Linux Security Advisory ASA-201605-13
Date : 2016-05-10
CVE-ID : CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
Package : squid
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package squid before version 3.5.19-1 is vulnerable to multiple
issues including denial of service, cache poisoning and same-origin
Upgrade to 3.5.19-1.
# pacman -Syu "squid>=3.5.19-1"
The problem has been fixed upstream in version 3.5.18.
- CVE-2016-4554 (cache poisoning, same-origin policy bypass):
Due to incorrect input validation, Squid is vulnerable to a header
smuggling attack leading to cache poisoning and bypass of the
same-origin security policy in Squid and some client browsers.
- CVE-2016-4555, CVE-2016-4556 (denial of service):
Due to incorrect pointer handling and reference counting, Squid is
vulnerable to a denial of service attack when processing ESI responses.
A remote attacker can smuggle a Host header value past some-origin
security protections to cause Squid to contact the wrong origin server.
This can also be used to poison a downstream cache storing the response,
browser or forward proxy, if this cache does not follow RFC 7230 and
lets the smuggled value through.
A remote attacker controlling a downstream server can trigger a denial
of service by delivering a crafted ESI response.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security